Applications for Preservation and Production in our Digital World

Transcription

1 Applications for Preservation and Production in our Digital World Gavin W. Manes, Ph.D. President, Digital Forensics Professionals, Inc. Research Assistant Professor, The University of Tulsa Background Gavin Manes Ph.D. Founder of Oklahoma Digital Forensics Professionals, Inc. (OKDFP) Research assistant professor of computer science at the University of Tulsa Center for Information Security Briefed the White House, National Security Council, Internal Revenue Service, FBI, and Pentagon University of Tulsa Leading institute for information assurance and digital forensics Operates forensics center with OSBI, Secret Service, and FBI OKDFP was first company commercialized via the Board of Trustees Technology Transfer Initiative 1

2 It is difficult to deny the global impact of electronic communication on business. Over 90 percent of all information is in electronic format.» The Digital Evidence Project (American Bar Association) Discussion areas: Preservation and Production Digital Forensics Preservation and Production Lawyers and judges interpreted the term "documents" to include electronically stored information because it was obviously improper to allow a party to evade discovery obligations on the basis that the label had not kept pace with changes in information technology Amendment Federal Rules of Civil Procedure, Rule 34 2

3 Challenges Legal Number one litigation problem is preserving and producing digital evidence Fulbright survey of corporate counsel Eighty six percent (86%) of corporate or in-house legal departments lack e-discovery plans or policies 2005 EDDix corporate litigation readiness study Rules and regulations 2006 amendments to Federal Rules of Civil Procedure Responsibilities Obligation to preserve evidence Obligation to preserve evidence begins the moment you knew or should have known the evidence was potentially relevant to future litigation - Zubulake v USB Outside Discovery request Preservation letter Litigation filed Intrusion Inside Harassment Whistleblower Employee separation Intellectual property 3

4 Digital Devices Computers, Servers and Network Devices Hard drives Internet logs Chat history Hacking, etc. Removable Media Floppy disk CD/DVD-Rs Media cards Removable hard disks, etc. Portable Electronic Devices MP3 players GPS systems Cell phones PDAs, etc. Digital Cameras Photographs Time stamps Metadata Faxes and Printers Fax communication history Print logs, etc. Communications Devices Voice mail PBX Call records, etc. Surveillance / DVR Equipment Automobiles Case Law Coleman Holdings, Inc. v Morgan Stanley & Co., Inc. Morgan Stanley preservation abuses: Overwriting after 12 months SEC regulations require accessible for two years Failing to conduct proper searches for backup tapes Court ordered that: Abuses would be read to the jury by the court Plaintiff could argue concealment was evidence of malice Burden of persuasion was switched from plaintiff to the defendant Jury awarded for plaintiff punitive and compensatory damages in excess of $1.45 billion 4

5 New Federal Rules of Civil Procedure Planning for discovery Rule 16(b)(5) & (6): Pretrial conferences 26(f): Specification of form Discoverable documents Rule 34: Confirming the document for e-discovery Burden and cost Rule 26: Accessible vs. inaccessible data Privileged document protection Rule 26: Protection against waiving privilege Going Forward Develop preservation and production framework Develop preservation and production framework Understand legal obligations to retain electronic records Develop and implement methods for employee training and education Integrate digital forensics electronic preservation program Redact privileged information Electronic production 5

6 Digital Forensics The process of identifying, preserving, analyzing and presenting digital evidence in a manner that is legally acceptable. - McKemmish Digital Forensic Duplication Forensic duplication of a hard drive Must be captured without modification Acquisition method must: Copy the entire media in a bit-by-bit manner Cryptographically seal the evidence to prevent tampering This method is more comprehensive than simply copying all the files from the media and avoids the changes that can be made by using the operating system to make a typical copy. 6

7 Digital Forensic Analysis Forensic analysis Examine drive image to search for targeted content Allows examination of all data including hidden, deleted, system, and unallocated files Access Data Toolkits Valuable experience with the Forensic Toolkit as well as training in forensics fundamentals and AccessData bootcamp. Cisco Certified Network Associate The CCNA certification indicates a foundation in and apprentice knowledge of networking. Center for Information Security NSA designated Center of Excellence in Information Assurance Education. Certified Information Systems Security Professionals This program consists of a series of courses that emphasize security issues and approaches fundamental to the protection of the information infrastructure. Summation Legal Technologies, Inc. Experience with America's number one litigation support software. High Technology Crime Investigation Association World's largest organization for high technology crime investigators. Promotes, aids and affects knowledge about methods, processes, and techniques relating to investigations. Certified Information Systems Security Professionals Professionals certified in the areas of cryptography, physical security, business continuity planning, and law, investigation & ethics, among others. The Microsoft Certified Professional Professionals with the skills to successfully implement a Microsoft product or technology as part of a business solution in an organization. Qualys, Inc. Offers on demand security audit and vulnerability management solutions to organizations of all sizes. Access Data Toolkits Valuable experience with the Forensic Toolkit as well as training in forensics fundamentals and AccessData bootcamp. National IA Education & Training Program A set of criteria designed to measure Information Assurance academic programs and professionals. Computing Technology Industry Association CompTIA certification programs, such as the A+ certification, are the recognized industry standards for foundation-level information technology (IT) skills. 7

8 Contact Information Gavin W. Manes, Ph.D. Oklahoma Digital Forensics Professionals, Inc. President and Director of Research University of Tulsa Center for Information Security Research Assistant Professor 8